Cyber Security Compliance Officer — career path
StationX Intermediate
The GRC career at its entry, for compliance officers and security auditors: keep the organisation on the right side of the standards and the regulators, and check that the controls work. Security+ for the grounding, ITIL where the organisation runs on it, GRC, PCI DSS and privacy for the substance, the controls hands on, then ISO 27001 and CISA.
4 courses · 38 sections · 195 lectures · 11 labs · ≈ 12 h of hands-on labs
Free to start: the free lessons and guides for this roadmap →
Try a free cloud security lab: Left open (~4 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Security foundation
The technical vocabulary compliance and audit work is written in.
follows the whole CompTIA Security+ (SY0-701) roadmap: 11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
Learn
- PathFollow the CompTIA Security+ (SY0-701) path — the certification compliance and audit adverts list first
11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
9 steps — The industry-standard entry certification for a cyber security role.
Step 2 — Service management (recommended if your organisation runs on ITIL) Optional
The process framework the controls you check are built on, and your audit evidence comes from. Take it if your organisation runs on ITIL.
follows the whole ITIL 4 Foundation roadmap: 5 courses · 20 sections · 119 lectures
Optional: not counted towards your progress or finishing this roadmap.
Learn
- PathFollow the ITIL 4 Foundation path — useful where the organisation runs on ITIL; fewer compliance adverts ask for it than for the rest of this path
5 courses · 20 sections · 119 lectures
3 steps — IT service management. Not a security certification, but frequently required for senior IT roles and useful context for anyone running security as a service.
Step 3 — Governance, risk and compliance
Policies, controls, evidence and risk assessment — the compliance officer's daily work — and PCI DSS for anyone handling card data.
2 courses · 21 sections · 61 lectures
Learn
- CourseGovernance, Risk and Compliance (GRC) (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 50 lectures
- Training Overview 2
- Introduction 3
- Governance 6
- Risk Management 6
- Compliance 4
- Internal Controls 13
- Audit 4
- Cybersecurity 4
- Emerging Trends in GRC 4
- Conclusion 3
- Audio Version of Training 1
- CourseAn Introduction to PCI-DSS (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
10 sections · 11 lectures
- Training Overview 2
- Introduction 1
- PCI-DSS Requirements 1&2 Building and Maintaining a Secure Network and Systems 1
- PCI-DSS Requirements 3&4 Protect Account Data 1
- PCI-DSS Requirements 5&6 Maintain a Vulnerability Management Program 1
- PCI-DSS Requirements 7,8&9 Implement strong access control measures 1
- PCI-DSS Requirements 10&11 Regular Monitor and Test networks 1
- PCI-DSS Requirement 12 Maintain an Information Security Policy 1
- Summary and Close 1
- Audio Version of Training 1
Start with Governance, Risk and Compliance (GRC), the one introductory GRC course on this path, then PCI DSS if you handle card data.
Step 4 — Privacy and data protection
GDPR and privacy by design — the regulation most compliance roles carry.
2 courses · 17 sections · 134 lectures
Learn
- CourseEU GDPR Foundations Course (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 71 lectures
- Training Overview 2
- Introduction 1
- Module 1: Privacy origins and GDPR basics 11
- Module 2: Legitimate purposes and principles 6
- Module 3: Transparency through Privacy Notice 5
- Module 4: Inventory of processing activities and retention 8
- Module 5: Consent and Data Subject Access Requests 9
- Module 6: Data Protection Impact Assessment and risk assessments 9
- Module 7: Security of personal data and privacy by design 6
- Module 8: Data transfers and managing third parties 6
- Module 9: Data breaches 8
- CourseUltimate Privacy by Design MasterCourse (GDPR, CCPA etc) (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
6 sections · 63 lectures
- Section 1: Introduction 3
- Section 2: Privacy by Design generalities and principles! 8
- Section 3: Let's define a privacy by design Model! 16
- Section 4: Privacy by Design Model - Data Oriented Strategies 14
- Section 5: Privacy Analysis - The FAIR method for privacy risk 12
- Section 6: Let's create the privacy by design Methodology! 10
Step 5 — The controls, hands on
See controls built and evidenced — baselines, logging, privileged access, compliance evidence — and rate the risk they treat. SOX ITGC and COBIT, which audit adverts name, are learned on the job; no course for them is sold here.
11 labs
Practise
- Infra LabsSecurity Operations Practitioner — 11 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Enforce Segmentation and Approved Access PathsLevel: GuidedDuration: 1 h
- Harden a JumpBox for Secure AdministrationLevel: GuidedDuration: 1 h
- Secure Privileged Access and Auditing in Active DirectoryLevel: GuidedDuration: 1 h
- Establish a Windows Hardening and Security Logging BaselineLevel: GuidedDuration: 1 h
- Reduce DVWA Exposure by Using Compensating ControlsLevel: GuidedDuration: 1 h
- Implement TLS and Certificate Controls for a ServiceLevel: GuidedDuration: 1 h
- Integrated Hardening Sprint A: Segment, Harden, and Secure ServicesLevel: AdvancedDuration: 1 h 30 min
- Governance and Compliance Evidence CollectionLevel: GuidedDuration: 1 h
- Prioritize Risks and Implement One RemediationLevel: GuidedDuration: 1 h
- Threat Modeling to Controls: Identify Risks and Implement MitigationsLevel: GuidedDuration: 1 h
- Establish centralized logging by onboarding hosts and validating monitoring readinessLevel: GuidedDuration: 1 h
Step 6 — The standard
Implement the standard you will be measured on, then plan, run and report an ISMS audit against it.
follows the whole ISO/IEC 27001:2022 — Lead Implementer and Internal Auditor roadmap: 5 courses · 34 sections · 290 lectures · 7 labs · ≈ 9 h of hands-on labs
Learn
- PathFollow the ISO/IEC 27001:2022 — Lead Implementer and Internal Auditor path — implementation and internal audit — the audit method itself
5 courses · 34 sections · 290 lectures · 7 labs · ≈ 9 h of hands-on labs
3 steps — The international standard for information security management.
Open the full ISO/IEC 27001:2022 — Lead Implementer and Internal Auditor roadmap →
Step 7 — The audit certification
The credential that opens the senior compliance and audit roles.
follows the whole CISA — Certified Information Systems Auditor roadmap: 6 courses · 38 sections · 205 lectures · 24 labs · ≈ 33 h of hands-on labs
Learn
- PathFollow the CISA — Certified Information Systems Auditor path — the information systems auditor certification compliance and audit adverts converge on — needs 5 years' experience to certify, of which up to 3 can be waived for education (you can pass the exam first)
6 courses · 38 sections · 205 lectures · 24 labs · ≈ 33 h of hands-on labs
5 steps — The audit and assurance certification. The standard credential for IT audit, and increasingly asked for in compliance-heavy sectors.
Open the full CISA — Certified Information Systems Auditor roadmap →
Where this leads
Choose your next roadmap
Advanced · after the job
The AI-Driven Cyber Security Compliance Officer
Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.
See the AI Master's Program →Application-only. A separate programme for when you're ready.